# CVE-2026-91992: Tornado CurlAsyncHTTPClient credential leak via handle reuse

Source: https://junglewise.ai/threats/cve-2026-91992-tornado-curlasynchttpclient-credential-leak-via-handle-reuse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91992 · Severity: medium · CVSS 5.9 · Published 2026-09-15

Tornado's HTTP client implementation reuses network connections across requests but fails to clear sensitive authentication state between them. An attacker who can influence multiple requests through the same client instance can steal TLS certificates, proxy credentials, or force requests through unintended network interfaces. This is a serious risk in multi-tenant or proxy-based deployments where credentials should be isolated per-request.

Technologies: [tornado (PyPI)](https://junglewise.ai/threats/technologies/tornado). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-91992 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91992 being exploited in the wild.

**How severe is CVE-2026-91992?** Medium severity, with a CVSS score of 5.9, published 15 September 2026.

**Which products and versions are affected?** tornado (PyPI) ECOSYSTEM:introduced=0,fixed=6.5.7.

**Is there a fix for CVE-2026-91992?** Yes. tornado (PyPI): upgrade to 6.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91992 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-91992?** Check whether you run tornado (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tornado (PyPI): upgrade to 6.5.7 or later

  ```sh
  pip install "tornado>=6.5.7"
  ```


## Technical details

CurlAsyncHTTPClient in tornado/curl_httpclient.py pools and reuses pycurl handles for performance, but _curl_setup_request() does not call curl.reset() between requests. Per-request options like SSLCERT, SSLKEY, PROXYUSERPWD, and INTERFACE are set conditionally and lack corresponding unset/clear branches, causing sensitive state from one request to leak into subsequent requests on the same client instance. Attack vectors include: (A) client TLS certificate persistence allowing an attacker's request to present the certificate during TLS handshake to an unintended host, and (B) proxy authentication credentials persisting and being sent to a different proxy. No user interaction or authentication is required; the vulnerability is triggered by issuing multiple HTTP requests through a shared client instance. Tornado 6.5.7 patches this by properly resetting pycurl handles between requests.

## Affected products

- Tornado Tornado before 6.5.7

## Identifiers

- CVE-2026-91992
- GHSA-pw6j-qg29-8w7f

## Timeline

- 2026-06-08: disclosed: GitHub Security Advisory GHSA-pw6j-qg29-8w7f published
- 2026-06-08: patched: Fixed in Tornado 6.5.7
- 2026-09-15: advisory: NVD entry published

## References

- [https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f](https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f)
- [https://www.vulncheck.com/advisories/tornado-before-6.5.7-credential-leak-via-handle-reuse](https://www.vulncheck.com/advisories/tornado-before-6.5.7-credential-leak-via-handle-reuse)

## Related threats

- [Tornado open redirect in RedirectHandler URL templates](https://junglewise.ai/threats/cve-2026-116578-tornado-is-a-python-web-framework-and-asynchronous-networking)
- [Tornado HTTP header parser quadratic CPU consumption via line folding](https://junglewise.ai/threats/cve-2026-116577-tornado-is-a-python-web-framework-and-asynchronous-networking)
- [Tornado HTTP/1.1 chunked encoding denial of service](https://junglewise.ai/threats/cve-2026-115927-tornado-is-a-python-web-framework-and-asynchronous-networking)
- [Tornado StaticFileHandler path traversal via symlinks](https://junglewise.ai/threats/cve-2026-103263-tornado-staticfilehandler-follows-symlinks-outside-static-root)
- [Tornado CurlAsyncHTTPClient unbounded memory accumulation in decompression](https://junglewise.ai/threats/cve-2026-103262-tornado-curlasynchttpclient-enforces-no-response-size-limit)